Privacy Policy

This Privacy Policy describes how Abdulla AAA Gaming Studio (Trade License No. 1632131, Dubai, UAE) ("we", "us", or "our") collects, uses, and safeguards information when you play Crypto Brawler or visit our websites.

1. Scope & Commitment to Player Privacy

Crypto Brawler is an educational and entertainment gaming application. We believe in minimal data collection and transparent processing. We do not sell your personal information to data brokers or advertisers.

2. Information We Collect

• Age eligibility: New players need an email account and a submitted date of birth confirming they are 18 or older. Players with a profile registered before September 21, 2026 at 14:22 UTC do not need to submit a birth date. We store your email and date of birth in private account records, not public player profiles. A date of birth is self-declared and is not identity verification.
• Registered Accounts: When signing in via Google Authentication or email, we collect your authentication UID, email address, chosen fighter nickname, and in-game achievements to maintain cross-session cloud synchronization.
• Payment Data: All in-app purchases of virtual Bcoin packs are processed directly by certified third-party payment gateways (e.g. Stripe, Apple Pay, Google Pay). We do not collect, process, or store your credit card, bank account, or financial credentials on our systems.
• Simulated Price Data & Web3: While the game simulates cryptocurrency market conditions, we never request, store, or have access to private cryptographic keys or seed phrases. Any Web3 wallet connection is purely client-side read-only for authentication/in-game cosmetic attribution.
• Campaign sources: We save campaign tags, the referring hostname and an inferred traffic source with registrations. The browser retains the last identifiable source for up to 30 days. This helps us understand which campaigns bring players to the game.
• Technical Telemetry: Standard diagnostic data such as browser user-agent, operating system, and anonymous performance analytics (via Google Analytics 4) to monitor game stability and latency.

3. How We Use Information

We use collected data solely to:

• Deliver and maintain real-time game rounds, match leaderboards, and tournament gauntlets.
• Measure campaign visits and completed registrations.
• Verify and credit virtual in-game token packages and unlocked fighter skins.
• Detect, investigate, and prevent exploits, fraudulent access, or malicious server attacks.
• Comply with applicable legal obligations under UAE law and consumer protection mandates.

4. Data Retention & Security

We implement robust technical safeguards, encrypted data transmission (HTTPS/TLS 1.3), and strict Firebase Firestore security rules to protect user profiles. Non-registered guest data remains under your direct control and can be cleared at any time by clearing your browser cache.

5. Your Rights (UAE PDPL & International Standards)

In accordance with UAE Federal Decree-Law No. 45 of 2021 regarding Personal Data Protection (PDPL) and international privacy frameworks, you have the right to:

• Request access to the personal data we hold about your account.
• Request immediate correction or deletion of your profile and leaderboard history.
• Withdraw consent or opt-out of optional analytics cookies.
• Unsubscribe from our emails at any time with the link in every email, and withdraw ad-audience consent by contacting us.

To exercise any of these rights, contact our Data Protection representative at [email protected].

6. Third-Party Services

Our game utilizes trusted third-party infrastructure providers:

• Google Firebase: Cloud hosting, authentication, and secure Firestore database.
• Google Analytics 4: Aggregate, anonymized traffic and gameplay event diagnostics.
• Optional Meta matching: After the adult age check, you can choose to share SHA-256 hashed versions of your email and date of birth with Meta for advertising measurement. Hashing is not anonymization. These details are matching fields, not general analytics event parameters. Declining this option does not prevent play.
• Emails (Brevo): We send a one-time welcome email to verified accounts, and game updates and offers only if you opt in. Emails are delivered by Brevo (Sendinblue SAS). Each email contains a small image that tells us whether it was opened, and its links carry campaign tags so we can see which emails bring players back. Every email has an unsubscribe link that works in one click.
• Optional ad audiences (Meta and Google): If you tick "Allow my hashed email to be used to show me Crypto Brawler ads on Meta and Google", we may upload a SHA-256 hash of your email address to Meta (Custom Audiences) and Google Ads (Customer Match) so they can show you, or exclude you from, Crypto Brawler ads and find similar audiences. Hashing is not anonymization. This is separate from the Meta matching option above, is off unless you choose it, and does not affect play. Contact us to withdraw it; we remove you from the next upload.
• X advertising pixel: On the game, tutorial and welcome pages, X receives website-visit signals and a conversion event after a fighter profile is saved. These signals help measure advertising results. Our registration event sends a random conversion ID for deduplication; we do not add the fighter name, email address or phone number to that event. X may use browser, cookie and ad-click information collected by its pixel. See X’s Privacy Policy.
• Stripe: PCI-DSS compliant payment processing for optional virtual currency bundles.